CVE-2026-36182: GNCC GP5 v7

Synopsis

Weak password hashing in GNCC GP5 v7 allows an unauthenticated network-based attacker to recover the root password through brute-force cracking. The device stores its root password using a weak hashing algorithm, meaning any attacker who obtains the hash (for example by reading a config file or intercepting a credential store) can crack it offline and escalate to full root privileges. Successful exploitation gives the attacker complete control over the device, with full read, write, and availability impact. No fix version has been published yet; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is reachable over the network, meaning an attacker can initiate the attack remotely without physical access to the host.

• AuthenticationNot required

  No account or credentials are required to retrieve or target the weak password hash; the attack path is open to unauthenticated parties.

• Victim interactionNot required

  No user action is needed; the attacker can execute the brute-force cracking attempt entirely without victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the brute-force or hash-cracking technique is reliable and requires no special environmental conditions or race timing.

Blast Radius

• A successful attacker recovers the root password and authenticates to the device as root, gaining unrestricted command execution.
• Full confidentiality impact means the attacker reads any data accessible to root, including configuration secrets, stored credentials, and private key material.
• Full integrity impact means the attacker modifies or replaces any file or configuration on the device, including firmware, access controls, and network settings.
• Full availability impact means the attacker can halt services, reboot the device, or render it permanently unresponsive.